Method and Systems for Monitoring Changes for a Server System

ABSTRACT

A method and systems for monitoring changes for a server system are disclosed. All data contents, for a first time point, of a dataset of the server system are obtained, and all data contents for a second time point of the dataset are also obtained. The first time point contents of the dataset are compared with the second time point contents of the dataset. The comparison is then used to determine a change for the server system between the first and second time points. The first time point contents of the dataset may be stored and, following the steps of comparing and using the comparison, a record of the change determined may be stored, and the stored first time point contents of the dataset discarded.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the benefit of and priority to European PatentApplication No. 16173813.3, filed Jun. 9, 2016. The entire disclosure ofthe above application is incorporated herein by reference.

FIELD

This disclosure is directed to methods and systems for monitoringchanges for a server system, such as a database server system.

BACKGROUND

This section provides background information related to the presentdisclosure which is not necessarily prior art.

Generic database systems and server systems are well known to the art.Generally, such systems include at least one server machine hostingdatabase information or data, and usually a server or databasemanagement system.

Such systems are often dynamic, in that the data held by the server, thedatabase or the database management system are regularly updated withnew information or data, or with rearrangement, reformatting, removal orthe like of existing information. Such systems are also subject topossible errors or inconsistencies in the data held.

Certain basic monitoring systems for server systems are known. Suchsystems are typically passive, in that they are usually only active whena problem occurs in the database, which triggers the monitoring system.Previously considered systems are usually also simplistic, in that theyonly monitor the database for certain types of problems or changes. Suchsystems may also only monitor items which have been flagged as changesto the system. Changes to the system which have not been flagged, butnevertheless been made, may therefore be overlooked. Previous systemsmay also only look for specific changes, specific types of changes, orin specific locations for changes. Thus alterations or modifications inareas not specified or monitored may also be missed. The fact that thesesystems may search for changes specifically may also be a disadvantage.

Backup devices for such systems are also known, however these aretypically merely for redundancy of the data on the system, rather thanfor any monitoring or analysis of it.

The present disclosure aims to address these problems and provideimprovements upon the known devices and methods.

SUMMARY

This section provides a general summary of the disclosure, and is not acomprehensive disclosure of its full scope or all of its features.Aspects and embodiments of the disclosure are set out in theaccompanying claims.

In general terms, one embodiment of a first aspect of the disclosure canprovide a method of monitoring changes for a server system, comprising:obtaining all data contents, for a first time point, of a dataset of theserver system; obtaining all data contents, for a second time point, ofthe dataset of the server system; comparing the first time pointcontents of the dataset with the second time point contents of thedataset; and using the comparison to determine a change for the serversystem between the first and second time points.

This allows a comprehensive method for determining changes in a datasetof a server system; as the entire, total or complete contents of thedataset are obtained, no change in that dataset should be missed, forexample by looking only for certain types of change. The comparison withthe contents at the second time point provides the means for finding thechange between the two full contents snapshots of the dataset. Thismethod also concentrates first on collecting all the data first, andthen on what the change might be, in contrast to previous methods whichattempt to search for a change before obtaining data relating to such achange.

The server system may be a database server system, such as those knownto the art. The change determined, for the server system, may be anyalteration, modification, variance, discrepancy, difference, divergenceor the like in the data, or relating to the data of the server system.For example, a change in a data object, such as a table of the database,may be found in the processing or analysis of the data.

The comparison of all contents of the dataset at the respective timepoints means that all possible comparisons between data in thosedatasets are available. As the dataset is the same dataset, at differenttime points, the content may differ between the time points (i.e. theremay be a first version and a second version), and hence a change can bedetermined. However, the dataset itself can be the same dataset, whetheror not it has been modified in the meantime.

Preferably, the method comprises storing the first time point contentsof the dataset; and following the steps of comparing and using thecomparison, storing a record of the change determined. More preferably,the method comprises, following the step of storing the record of thechange determined, discarding the stored first time point contents ofthe dataset.

This allows for only the change determined to be stored, and forredundant data (such as old previous dataset contents) to be deleted.This therefore allows for consolidation, de-cluttering of the monitoringstorage, and potentially frees up that resource for other uses in thesecond hardware system. The method of this embodiment can therefore atany given time, store one or more recorded changes (determined bycomparison between subsequent data), alongside the present data readyfor comparison with the next data received.

Suitably, the method comprises storing the second time point contents ofthe dataset; obtaining all data contents, for a third time point, of thedataset of the server system; comparing the second time point contentsof the dataset with the third time point contents of the dataset; usingthe comparison to determine a change for the server system between thesecond and third time points; storing a record of the change determined;and discarding the stored second time point contents of the dataset.

In an embodiment, the step of comparing comprises determining adifference between the respective time point contents of the dataset,and the step of using the comparison comprises noting the determineddifference as the change for the server system between the respectivetime points.

In another embodiment, the steps of obtaining all data contents compriseduplicating all data contents, for the respective time point, of thedataset of the server system.

Preferably, the server system is operated on a first hardware system,and the method comprises: transferring the data duplicated from theserver system from the first hardware system to a second hardware systemseparate from the first hardware system; and processing the duplicateddata on the second hardware system to determine a change for the serversystem between the respective time points.

This removal of the monitoring process to a separate system allows themonitoring of the server system to be carried out away from the systemitself, so that the system is not disturbed or interfered with duringthe monitoring process. This also means that local resources are notbeing used for the monitoring process. The duplication of the data forremoval means that much more detailed analysis can be carried out on thedata, as the data is no longer housed by the server and can therefore bemore freely examined and interfered with. This can also allow moreintensive and more frequent analysis of the data, and allows thepossibility of far more active and “always-on” analysis, as the localdata is not disturbed.

Suitably, the method comprises, following determining the change for theserver system between the respective time points, generating an alertreporting said change.

In embodiments, the method comprises: storing a record of the determinedchange; comparing the determined change to a stored record of apreviously determined change for the server system; and using thecomparison to evaluate the current change for the server system.

This allows for prioritisation and categorisation of changes determined,and also for monitoring of the historical progression of changes ofgiven types or locations.

In embodiments, the server system is a database system, and comprises: adatabase; and a database management system. The database and/ormanagement system may comprise a database schema, a databaseadministrator or the like.

Suitably, the data duplicated from the server system comprises datarelating to one or more of: data objects; schema; size; status; accesshistory; synchronisation; replication; operating system; and managementparameters of a database of the server system. In embodiments, the stepof using the comparison to determine a change may comprise comparingdata relating to one or more of these.

For example, the data may relate to a change in status of the system,from a normal running mode to an error mode. The processing maytherefore determine the change between these modes from the datacompared. In another example, the processing may find a change in a dataobject, such as an edited object in a relational table database.

One embodiment of a second aspect of the disclosure can provide a methodof detecting changes for a server system comprising: obtaining contentsfor a first time point of a dataset of the server system; obtainingcontents for a second time point of the dataset of the server system;and comparing the contents for the first time point with the contentsfor the second time point, to determine a change in the server systembetween the first and second time points.

One embodiment of a third aspect of the disclosure can provide a systemfor monitoring changes for a server system, comprising a processorconfigured to carry out the above.

One embodiment of a fourth aspect of the disclosure can provide a systemfor monitoring changes for a server system, comprising: a first hardwaresystem on which the server system is operated; a second hardware systemseparate from the first hardware system, comprising at least oneprocessor; and a transmission device configured to transfer data fromthe server system from the first hardware system on which the serversystem is operated, to the second hardware system, wherein the processorof the second hardware system is configured to: obtain all datacontents, for a first time point, of a dataset of the server system;obtain all data contents, for a second time point, of the dataset of theserver system; compare the first time point contents of the dataset withthe second time point contents of the dataset; and use the comparison todetermine a change for the server system between the first and secondtime points.

The second hardware system may comprise a monitoring server system, andthe first hardware system may comprise a server, such as a databaseserver. The (database) servers may therefore be the clients of themonitoring server system, and the (database) servers may serve datasource clients, providing database services for those clients. Thehardware systems may be single or distributed systems, or components ofsuch systems.

Further aspects of the disclosure comprise computer programapplications, or computer readable media comprising computer programcode, adapted, when loaded into or run on a computer or processor, tocause the computer or processor to carry out a method according to anyof the aspects and embodiments described above.

The above aspects and embodiments may be combined to provide furtheraspects and embodiments of the disclosure.

Processors and/or controllers may comprise one or more computationalprocessors, and/or control elements having one or more electronicprocessors. Uses of the term “processor” or “controller” herein shouldtherefore be considered to refer either to a single processor,controller or control element, or to pluralities of the same; whichpluralities may operate in concert to provide the functions described.Furthermore, individual and/or separate functions of the processor(s) orcontroller(s) may be hosted by or undertaken in different control units,processors or controllers.

To configure a processor or controller, a suitable set of instructionsmay be provided which, when executed, cause said control unit orcomputational device to implement the techniques specified herein. Theset of instructions may suitably be embedded in said one or moreelectronic processors. Alternatively, the set of instructions may beprovided as software to be executed on said computational device.

Further areas of applicability will become apparent from the descriptionprovided herein. The description and specific examples and embodimentsin this summary are intended for purposes of illustration only and arenot intended to limit the scope of the present disclosure.

DRAWINGS

The drawings described herein are for illustrative purposes only ofselected embodiments and not all possible implementations, and are notintended to limit the scope of the present disclosure. The disclosurewill now be described by way of example with reference to theaccompanying drawings, in which:

FIG. 1 is a diagram illustrating steps of a method according to anembodiment of the disclosure;

FIG. 2 is a schematic diagram illustrating a monitoring system accordingto an embodiment of the disclosure;

FIG. 3 is a diagram illustrating components of a monitoring systemaccording to an embodiment of the disclosure;

FIG. 4 is a diagram illustrating components of a server system accordingto an embodiment of the disclosure; and

FIG. 5 is a diagram illustrating steps of a method according to anembodiment of the disclosure.

Corresponding reference numerals indicate corresponding parts throughoutthe several views of the drawings.

DETAILED DESCRIPTION

Embodiments of the present disclosure will be described, by way ofexample only, with reference to the drawings. The description andspecific examples included herein are intended for purposes ofillustration only and are not intended to limit the scope of the presentdisclosure.

Embodiments of the disclosure provide systems and methods for monitoringchanges to a server or database, by taking the entire contents of adataset from the server/database, and later taking the entire contentsagain, and comparing the two versions. This is in contrast to previousschemes, which attempt to find changes or errors in certain locations orin certain specific ways, or check changes already marked. Features ofthis kind allow advantages of the disclosure such as providing acomprehensive or fail-safe monitoring system, whether or not a specifictype or location of change is being sought.

Embodiments of the disclosure might be considered “dumb” or simplisticcompared to previous methods having highly complex methods of change orerror detection. They can be considered somewhat counter-intuitive inthis way, and furthermore in that copies of entire datasets are made,which would previously have been considered highly inefficient forfinding changes or errors which would typically be miniscule incomparison.

In addition, by moving all processing of the data(comparisons/identifying differences) away from the monitoreddatabase/server and onto a centralised hub, systems of embodiments ofthe disclosure can better afford to run these scans on full data sets,which previously considered tools may have been considered inefficientor performance impacting.

Methods and systems of the disclosure can also be contrasted with merebackup systems—these simply copy versions of a data source, or moreusually, store copies of any new data since the last backup. There is noattempt in such schemes to determine any changes in the data. In fact,an embodiment of the disclosure can provide a simple means oferror-checking a backup system. Take a system in which backup copy A hasbeen made of a dataset X, and information time-stamped as post-datingthat initial backup has been stored in backups B and C. An embodiment ofthe disclosure can compare the contents of X at the time points for A, Band C, and check that the contents of B and C properly reflect thechanges which existed at those time points.

Embodiments of the disclosure are applicable to databases and databasesystems, but also to server systems which may not necessarily bedesignated as database servers, but nevertheless store data, themanagement of which may require monitoring.

Embodiments of the disclosure are server/database (DB) monitoring toolswhich will, for example, alert a user or other system when changes aremade to a database, for instance to a schema within an object-relationaldatabase or database management system. The tools can accommodate thenecessity for change control and schema change integrity within databaseadministration.

The monitoring tool itself can reside within the hub monitoring system(such as that shown in FIG. 2 (204)), and all functionality (comparing,storing results, etc.) can happen within the hub. There may also beprovided a GUI frontend dashboard to view the reports/alerts/tooladministration and configuration, along with email based alerting.

The tool can monitor/alert on any structured IT infrastructure system,such as a database management system, or OS server (Linux, windows, MACOS, etc.). Data being collected is regarding the current state of thestructure within the monitored infrastructure, a “snapshot” of a givenpoint in time. The tool itself can be designated a database- orserver-centric comparison engine, which pulls data from variousstructured IT infrastructure.

Embodiments of the disclosure can provide a monitoring application whichis ‘always on’. In embodiments, the system can be self maintained, forexample:

-   -   in terms of growth (the application can delete redundant data        and utilise reclaimed space to reduce costs of running the        application);    -   in terms of monitoring/alerting (checks can be scheduled and        alerts automated, which removes the need for manual efforts to        maintain the application).

Embodiments of the disclosure promote proactive monitoring rather thanpassive monitoring; since potentially the entire database/dataset isduplicated regularly and monitored for changes, all possible changesshould be noted. This information can therefore be used to bettercontrol the monitoring process.

One previously considered monitoring system may monitor a change in thecurrent status of a process of a pre-defined rule, for example, thestatus of a database changing from open to closed, which may prompt analert. Embodiments of the disclosure in contrast provide comparison ofchanges which can allow different types of monitoring analysis to beperformed, such as tracking the progress of changes to a database, ormonitoring the frequency of changes. The systems of embodiments aretherefore aware of how an environment has looked/changed in the past,and can alert on changes that previously considered monitoring toolswould not have considered an event.

Embodiments of the disclosure can provide the following benefits:

-   -   Reduce risk of database administration (DBA) errors and/or        issues caused by erroneous schema changes;    -   Identify invalid DB objects and when objects became invalid;    -   Provide historical reports on all changes;    -   Provide database capacity planning via database space usage        reports;    -   Ensure DBA standards are being adhered to in all environments;    -   Ensure security and compliance standards are being adhered to in        all environments.

Another feature provided by embodiments of the disclosure is the abilityto ensure all environments of a system are identical or meetrequirements. For example, the tool can monitor/alert if a productionenvironment is not identical to pre-production/lower environments.

In addition, in embodiments, the more these systems are used, the moreefficient they become. Rules and comparisons can be based on collecteddata so the more data that is available, the more accurate the resultswill be. Each tool in the suite can also utilise data collected fromother tools. Using the application as an entire suite increases theaccuracy, performance and intelligence of the individual tools.

FIG. 1 is a diagram illustrating steps of a method according to anembodiment of the disclosure. First, all data contents for a first timepoint of a dataset of the server system are obtained 102. Data contentsfor a second time point of the same dataset are also obtained 104. Thefirst time point contents are compared 106 with the second time pointcontents, and the result of the comparison is used to determine a changefor the system between the first and second time points. For example,this may be a simple change in the dataset itself. In a counter example,it is possible that the result of the comparison will give a nullresult, which can be used to determine that the system has changed; forexample, it may be expected that the dataset is constantly updating andbeing modified, and if the comparison 106 yields no result, thiscomparison can be used to flag a change in the system, i.e. that theserver data or database has not been updated or modified during thosetime points.

The data housed in the data area or database can be any type of datasuitable for a database or monitorable dataset. The data addressed bythe monitoring system (i.e. that duplicated from the system) can be anydata from the server or database itself, or from the database managementsystem. For example, the data may be data objects in or from thedatabase itself; a data item in the database may be altered. It may bedata from or relating to the database schema, such as parametersgoverning the structure or functionality of the database; for example,an integrity constraint may be changed. It may be the size of thedatabase or data area of the server; a number of objects, size of amatrix or table of values may have been altered, for example by adding acolumn to a table. It may be a status of the server or database; forexample, toggle data noting that the database is running, or down; datanoting that given software is installed/running. It may relate to accesshistory; data logs showing which users have accessed the server ordatabase will change with new access instances. It may relate tosynchronisation or replication of the database; data denoting when orwhether these have occurred recently, or indicating degrees of success.It may relate to the operating system in use. The data may also be orrelate to management parameters of the database management system; forexample, records of events, actions taken during management, or changesin management systems.

The dataset of the server/database which is obtained or duplicated ineach step may include all data from the entire database or data area, inall data categories. Alternatively, it may only include all data from asubset of the database, for example for one of the categories notedabove. Where the database is distributed, for example across multiplehardware systems, the (entire/complete) dataset obtained may includedata from more than one individual storage means on a respective suchhardware system.

The processing for determining the change will be described in moredetail below with reference to FIG. 5.

In an embodiment, all tools in the monitoring suite identifychanges/differences using a ‘scan’ approach. A scan takes a snapshot ofan environment at a given time. Comparing the current scan with the lastscan can identify any differences in that time period.

In embodiments, the comparison engine may take the following steps:

-   -   i. during a ‘scan’ of a monitored system or infrastructure, data        is pulled into a centralized hub by various techniques,        depending on what type of infrastructure is being monitored;    -   ii. the data is then stored in database tables within the hub.        The data is labelled with a unique identifier and is also        assigned metadata such as a timestamp, a scan run number, a        name/description of monitored infrastructure;    -   iii. on the next scan, the same procedure is followed. Data is        pulled, stored and labelled with an identifier and metadata;    -   iv. the comparison tool initiates and looks for differences        between the two scan datasets;    -   v. results of the scan are then stored in result tables;    -   vi. result data is also assigned metadata, including:        -   date;        -   was there actually any difference at all (which will            determine if alerts are sent or not sent);        -   the severity of the difference—based on pre-defined            thresholds of severity, the amount of difference(s) will            determine the type/priority of alert sent;    -   vii. result data can now be used for:        -   alerting on changes in a system or infrastructure;        -   reporting on changes within a period of time, building a            timeline of changes;        -   identifying trends/patterns within an infrastructure based            on the changes happening over a time period;        -   future planning of infrastructure based on reporting data;        -   redesigning/improving infrastructure.

For example, with an embodiment in which a database schema is beingmonitored:

-   -   Day 1: a scan is run which captures a snapshot of a specific        schema    -   Day 2: changes are made to a table in the schema    -   Day 2: a scan is run which captures a new snapshot of the        schema. Comparison is made between Scan1 and Scan2 and the table        change is identified and alerted as a change.

In embodiments, the system can work on a ‘hub and spoke’ model. Theapplication monitoring the system runs on a centralised hub and monitorsmultiple client server or DB environments by pulling the relevant datafrom each client into the hub and running comparisons on the hub.

FIG. 2 is a schematic diagram illustrating a monitoring system accordingto an embodiment of the disclosure. The monitoring system 200 iscomprised of the plurality of server systems 202 a, 202 b, 202 c and thesingle monitoring system 204. Data can be drawn from the servers by thecentral monitoring system, as indicated by the arrows. The processing isthen carried out on the monitoring system. The monitoring system, havingdetermined changes in the servers can output reports or alerts 206 basedon the determined changes. For example, a report could list thehistorical changes for a given database, for a certain dataset. An alertcould be sent to a user or another system, when a change detected isparticularly significant, such as a large change to a dataset/database,or a change in a database which is not frequently accessed.

FIG. 3 is a diagram illustrating components of a monitoring systemaccording to an embodiment of the disclosure. The first hardware system300 houses the server system 301, a duplication module 302 and atransmission device 304. Data can be pulled from the system andduplicated by the duplication module, and then transferred elsewhere bythe transmission device. The medium by which the transfer takes place isindicated at box 305; this may be a network, which communicationsdevices on the first and second hardware systems communicate with. Itmay simply be that the two systems are directly connected.

The second hardware system 310 houses a receiver device 306 and aprocessor 308. The receiver receives the transferred duplicated datafrom the first hardware system, and passes it to the processor. Theprocessor undertakes tasks such as processing the data to determinechanges.

The first hardware system may be any such system capable of storing adatabase. The transfer of the data duplicated from the system, to thesecond hardware system can be implemented depending on the nature of theseparation of the first and second hardware systems. These may simply bephysically separated, though connected by wiring or a bus, for examplein a simple system containing two hardware subsystems. The transfer canthen simply be made along the bus. In a client-server type system, wherethe monitoring system is a server for the database clients, the transfermay be over a network.

FIG. 4 is a diagram illustrating the components, structure andfunctionality of a server system 400 according to an embodiment of thedisclosure, which can provide the features of the monitoring server 204shown in FIG. 2, for example processing the data to determine changes inthe monitored system(s). Note that a server such as this could alsoprovide the functionality for a server system such as those shown inFIG. 2 (server systems 202 a, 202 b, 202 c).

The server comprises a processing environment 420 with processor 421 andmemory 422, with associated communications functionality 423. Thecommunications functionality may include a networking capabilityallowing communication with a network, or directly with another serveror computer device, such as a monitoring server 204 or a server ordatabase system 202 a, 202 b, 202 c. This communication may be secured.The memory 422 may store readable instructions to instruct the processorto perform the functions of the monitoring system. The processor 421 isa representation of processing capability and may in practice beprovided by several processors. A database 410 is provided, storing dataas applicable. For the monitoring server 204, this database can providethe storage for previous data transferred from the databases, forrecords of previous changes, and the like. Elements shown within theprocessing environment 420 use the processor 421 and the memory 422 todeliver functionality; for example, these elements can provide steps ofembodiments of the disclosure such as comparing the contents of thedataset, and using the comparison to determine a change. A databasemanagement system 430 module can be located within the processingenvironment 420, to provide the management functions for a database. Thedatabase management system may also comprise functions of other parts ofthe server, such as the processor 421, the memory 422 and the database410 itself.

The computing devices noted above with reference to FIGS. 3 and 4 mayinclude one or more of logic arrays, memories, analogue circuits,digital circuits, software, firmware and processors. The hardware andfirmware components of the computing devices may include variousspecialized units, circuits, software and interfaces for providing thefunctionality and features described herein. The processor(s) may be orinclude one or more microprocessors, application specific integratedcircuits (ASICs), programmable logic devices (PLDs) and programmablelogic arrays (PLAs).

FIG. 5 is a diagram illustrating steps of a method according to anembodiment of the disclosure.

In a typical monitoring scheme using embodiments of the disclosure,duplicated data from the system is continually being transferred, forexample at scheduled times, to the separate hardware system so that thedata and the subsequent additions and updates to that data can beprocessed to find changes to the server/database.

In the embodiment shown in FIG. 5, as in FIG. 1, the entire datacontents of the dataset at the first 502 and second 504 time points havebeen obtained. Usually these will have been duplicated from the databaseand transferred to the hub, as in FIG. 3.

The first time point contents are then stored 505. As the process iscarried out in a later iteration, the two time points will of course besecond and third time points, and so on. A later iteration carries outthe same steps, denoted in FIG. 5 as steps 502 a to 510 a.

The stored first time point contents are then compared with the secondtime point contents 506 as in FIG. 1, and then the comparison is used todetermine any change (at 508). This comparison may be done by any simpletechnique, including previously considered comparison techniques. Thisis in part because the method itself is essentially simple at thisstage; rather than a complex technique to isolate changes from a largedataset, the method copies the entire dataset in two versions, andsimply compares the versions. The comparison may simply compare eachdatum in the set with the datum in that register, position or the likein the second version of the set. Any difference in the data pairs willbe determined as a change.

More sophisticated comparisons of the datasets can also beperformed—subset pairs within the sets can be compared, for example. Thedata being compared may be able to be compared at different levels—thecode itself, or the numerical data, or data objects, or schemes or thelike may be compared. For example, a list of users for the two versionscan be compared, with any additions immediately clear from the length ofthe list, from additional characters in the list, from data size of thelist, or the like. A status indicator of the database could be thedata/datum to be monitored, in which case a comparison only of a pair ofsingle digits may be required. Fundamentally however, the comparisonitself can be simple, by any previously considered means, because theunderlying technique is a comparison of two datasets.

This comparison of the entire dataset with a previous version alsoallows far more detailed interrogation of the data than previous systemshave been permitted. Since all data is available, and all data compared,even the smallest change will be detected in the comparison. In previoussystems, change detection was only permitted at certain levels of thesystem, or had to rely on indicators at those higher levels of a changeactually located inside a data object.

The change determined is then recorded 510, and only the determinedchange itself. For example, if a new version of a data object containsnew data, the new parts of the data are stripped out and recorded; thusthe whole dataset need not be stored, merely the differences from theprevious version. For instance, a data object may contain additionalinformation in an additional column added in the latest version; onlythis additional column is stored.

Additionally, the first time point data contents can then be discarded514. This allows for a history of the changes to the database to bestored; it would likely be prohibitive to store each copy of the entirecontents of the dataset. By storing only the changes identified, and thelatest version of the dataset ready for comparison with the next versionobtained, the storage needed can be greatly reduced, sufficiently forthe record of each determined change to be maintained. This is infurther contrast to previous systems, which monitored merely by findingchanges and alerting to them, rather than recording their historyspecifically. For example, previous systems having identified that asystem is not working, would not have the data available in a history tobe able to identify that the system was malfunctioning in the same waythree days ago. This may be of use in determining a course of action forrectification, or for prevention of this malfunction in the future.

In a further step, the change itself, i.e. the difference between thefirst and second time point data which has been recorded 510, iscompared to a previous such determined change 512. For example, if adata object has been changed twice, a comparison of first/second timepoint data at the second time point will have picked up the first change(e.g. add a column), and a comparison of second/third time point data atthe third time point will have picked up the second change (e.g. add afurther column). A previous iteration (at 502 a-510 a) of the stepsoutlined above will have provided the previous determined and recordedchange.

Such comparison can allow different types of monitoring analysis to beperformed, such as tracking the progress of changes to aserver/database, or monitoring the frequency of changes. This can allowthe monitoring system to become more familiar with the database and itschanges as the monitoring progresses, and can allow prioritising andcategorisation of changes.

In an embodiment, combining the current full duplicated dataset and thepreviously stored detected changes, can be used to create a timelinereport showing all changes of the environment from the current point intime to the first day of monitoring.

A specific embodiment of the disclosure can be described as follows, inrelation to a database (server) system. The system works by queryingdatabase views for all objects and inserts the data into a centralizedrepository for comparison.

-   -   1. A package queries the database object views on each client        database and inserts them into the repository via a DB link.    -   2. The repository contains tables which will hold the data in        batch format from the Client DBs:        -   i. The first run will contain all the schema objects as            batch ID 1;        -   ii. The second run will hold all the schema objects as batch            ID 2.    -   3. There is a comparison package in the repository which will        query the tables:        -   i. The comparison looks for differences between the last            batch of inserted data and the second to last batch.    -   4. Any differences in the schemas between the two batches will        be written to a report and emailed;        -   i. the system will use scheduling and alerting facilities in            order run the reports.

The differences can also be stored, and batch ID 1 can be deleted,though batch ID 2 will usually be maintained for comparison with thenext scan run.

In embodiments, the hub monitoring system can be a centralisedrepository for all monitored environments within an organisation. Alldata is kept in the central hub and can be used, for example, forcompany-wide reporting. For instance, a report can be run to show thepercentage of all environments in the company that adhere to companystandards.

Embodiments of the disclosure can use features such as those describedabove to provide a suite of tools, each with their own specific role inmonitoring specific areas of a database infrastructure. Examples are:

-   -   Schema—monitoring any changes to objects (tables, indexes, etc.)        in a schema and alerting the relevant user, device, system, or        networked device when changes occur.    -   Capacity—tracking database growth and displaying growth patterns        in a graphical format.    -   Scan—showing differences between multiple databases, including        DB configuration settings, sizes, parameters, and the like.        Useful for comparing different environments of one DB (test vs.        production).    -   Audit—monitoring database user access that does not adhere to        audit standards (e.g., alert on developers who wrongfully have        admin privileges).    -   Data—monitoring tool that ensures replicated databases are in        sync and will alert when there are differences in data between        replicated DBs.    -   Server—alerting on changes to OS level of a database server.        Changes in memory parameters, configuration, software,        directories, permissions.    -   Infra—reporting on all software currently installed on a server.    -   Backups—checking and reporting on database backups. For example,        data recording how long backups take can be compared with more        recent data for this, to determine any spikes or lulls in backup        duration.    -   Replication—checking replication procedures.    -   Standard—checking that all DBs are in the appropriate directory,        and that servers are on the appropriate port, for example.

For example, Audit is a monitoring tool that checks the DB userpermissions which have been added or deleted from day to day. Thisprogram also checks changes in the status of a request from implemented,pending or emergency implementation.

Audit operates on the client to hub model of the monitoring system, inwhich an identity checking application takes the form of the client.Requests for access are made through the identity checking applicationand are sent from the client to the hub, as part of the regularduplicate data, transfer to hub procedures as described above with basicembodiments of the disclosure. At the hub, procedures are run againstthe data. Finally results are sent via email from the hub to adestination, for example an administrator checking access permissions.

The procedures run on the hub compare current data against previousscans, and isolate new data. Any new data i.e.: new requests, are storedin a scan results table. These new requests are the details reported byemail to the relevant party.

For example, Audit can check for any accesses of the database that donot have records in an identity check application (by detecting thechanges in the access record between versions of the dataset), or promptan alert on any access which has no request whatsoever.

In an embodiment, the audit reports can be filtered after the initialstep of comparing the data with previous data to find differences. Forexample, a filter can remove access requests for employees that have DBAroles. These requests will be noted and added to the results table butwill not be sent through the email system. This ensures only employeesthat are not entitled to access will have their request flagged.

As with other embodiments above, where data is no longer needed aftercompare procedures have been run, this can be removed to conserve space.The initial scan may need to be retained permanently; the current andprevious scan are needed to run procedures but will be removed asneeded.

Another example is the Schema tool, the purpose of which is to monitorany changes to a single database from day to day.

The following objects are monitored:

-   -   Tables        -   New or deleted tables        -   Table column definitions    -   Indexes        -   Status        -   Uniqueness        -   Indexed Columns    -   Procedures        -   New or deleted    -   Constraints        -   New or deleted        -   Constraint Type        -   Constraint Columns    -   Triggers        -   New or deleted        -   Status    -   Views    -   Table Partitions    -   Index Partitions

The monitoring system of embodiments of the disclosure can also providean overview of all monitoring tools, for example a dashboard applicationreflecting the results of the tasks the tools implement. This willcontain the specified information from the particular scans that areneeded for monitoring.

The dashboard itself will dynamically display key information in avariety of pages, depending on which scan tools are being/will beutilised.

It will be appreciated by those skilled in the art that the disclosurehas been described by way of example only, and that a variety ofalternative approaches may be adopted without departing from the scopeof the disclosure, as defined by the appended claims.

With that said, and as described, it should be appreciated that one ormore aspects of the present disclosure transform a general-purposecomputing device into a special-purpose computing device when configuredto perform the functions, methods, and/or processes described herein. Inconnection therewith, in various embodiments, computer-executableinstructions (or code) may be stored in memory of such computing devicefor execution by a processor to cause the processor to perform one ormore of the functions, methods, and/or processes described herein, suchthat the memory is a physical, tangible, and non-transitory computerreadable storage media. Such instructions often improve the efficienciesand/or performance of the processor that is performing one or more ofthe various operations herein. It should be appreciated that the memorymay include a variety of different memories, each implemented in one ormore of the operations or processes described herein. What's more, acomputing device as used herein may include a single computing device ormultiple computing devices.

In addition, the terminology used herein is for the purpose ofdescribing particular exemplary embodiments only and is not intended tobe limiting. As used herein, the singular forms “a,” “an,” and “the” maybe intended to include the plural forms as well, unless the contextclearly indicates otherwise. The terms “comprises,” “comprising,”“including,” and “having,” are inclusive and therefore specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof. The method steps, processes, andoperations described herein are not to be construed as necessarilyrequiring their performance in the particular order discussed orillustrated, unless specifically identified as an order of performance.It is also to be understood that additional or alternative steps may beemployed.

When a feature is referred to as being “on,” “engaged to,” “connectedto,” “coupled to,” “associated with,” “included with,” or “incommunication with” another feature, it may be directly on, engaged,connected, coupled, associated, included, or in communication to or withthe other feature, or intervening features may be present. As usedherein, the term “and/or” includes any and all combinations of one ormore of the associated listed items.

Although the terms first, second, third, etc. may be used herein todescribe various features, these features should not be limited by theseterms. These terms may be only used to distinguish one feature fromanother. Terms such as “first,” “second,” and other numerical terms whenused herein do not imply a sequence or order unless clearly indicated bythe context. Thus, a first feature discussed herein could be termed asecond feature without departing from the teachings of the exampleembodiments.

Again, the foregoing description of exemplary embodiments has beenprovided for purposes of illustration and description. It is notintended to be exhaustive or to limit the disclosure. Individualelements or features of a particular embodiment are generally notlimited to that particular embodiment, but, where applicable, areinterchangeable and can be used in a selected embodiment, even if notspecifically shown or described. The same may also be varied in manyways. Such variations are not to be regarded as a departure from thedisclosure, and all such modifications are intended to be includedwithin the scope of the disclosure.

What is claimed is:
 1. A method of monitoring changes for a serversystem, the method comprising: obtaining, by a processor, all datacontents, for a first time point, of a dataset of the server system;obtaining, by the processor, all data contents, for a second time point,of the dataset of the server system; comparing, at the processor, thefirst time point contents of the dataset with the second time pointcontents of the dataset; and using the comparison to determine a changefor the server system between the first and second time points.
 2. Themethod according to claim 1, comprising: storing the first time pointcontents of the dataset; and following the steps of comparing and usingthe comparison, storing a record of the change determined.
 3. The methodaccording to claim 2, comprising, following the step of storing therecord of the change determined, discarding the stored first time pointcontents of the dataset.
 4. The method according to claim 2, furthercomprising: storing the second time point contents of the dataset;obtaining by the processor all data contents, for a third time point, ofthe dataset of the server system; comparing, at the processor, thesecond time point contents of the dataset with the third time pointcontents of the dataset; using the comparison to determine a change forthe server system between the second and third time points; storing arecord of the change determined; and discarding the stored second timepoint contents of the dataset.
 5. The method according to claim 1,wherein the step of comparing comprises determining a difference betweenthe respective time point contents of the dataset; and wherein the stepof using the comparison comprises noting the determined difference asthe change for the server system between the respective time points. 6.The method according to claim 1, wherein the steps of obtaining all datacontents comprise duplicating all data contents, for the respective timepoint, of the dataset of the server system.
 7. The method according toclaim 6, wherein the server system is operated on a first hardwaresystem, the method further comprising: transferring the data duplicatedfrom the server system from the first hardware system to a secondhardware system separate from the first hardware system; and processingthe duplicated data on the second hardware system to determine a changefor the server system between the respective time points.
 8. The methodaccording to claim 1, further comprising, following determining thechange for the server system between the respective time points,generating an alert reporting said change.
 9. The method according toclaim 1, further comprising: storing a record of the determined change;comparing, at the processor, the determined change to a stored record ofa previously determined change for the server system; and using thecomparison to evaluate the current change for the server system.
 10. Themethod according to claim 1, wherein the server system is a databasesystem, and comprises: a database; and a database management system. 11.The method according to claim 1, wherein the data contents comprise datarelating to one or more of: data objects; schema; size; status; accesshistory; synchronization; replication; operating system; and managementparameters of a database of the server system.
 12. A system formonitoring changes for a server system, the system comprising aprocessor configured to: obtain all data contents, for a first timepoint, of a dataset of the server system; obtain all data contents, fora second time point, of the dataset of the server system; compare thefirst time point contents of the dataset with the second time pointcontents of the dataset; and determine, based on the comparison, achange for the server system between the first and second time points.13. A system for monitoring changes for a server system, the systemcomprising: a first hardware system on which the server system isoperated; a second hardware system separate from the first hardwaresystem, comprising at least one processor; and a transmission deviceconfigured to transfer data from the server system from the firsthardware system on which the server system is operated, to the secondhardware system; wherein the processor of the second hardware system isconfigured to: obtain all data contents, for a first time point, of adataset of the server system; obtain all data contents, for a secondtime point, of the dataset of the server system; compare the first timepoint contents of the dataset with the second time point contents of thedataset; and use the comparison to determine a change for the serversystem between the first and second time points.
 14. (canceled)